Let a partner adopt the owner's custom networks from the conf phase 1 already cached, instead of asking for a value it cannot know

2026-08-16 21:20:59 -04:00
parent 662f4f0d53
commit 3ae6298656
3 changed files with 111 additions and 2 deletions
@@ -397,6 +397,47 @@ if (!file_exists(CONF_DIR . '/' . $confFile)) {
    }
 }

+// ── Adopt the owner's custom docker networks ─────────────────────────────────────────────────
+// Sent by the wizard, which read them out of the owner's host conf that onboard Phase 1 cached
+// into the RAM conf dir. This is the one setup value a fresh mirror has no way to know: the
+// template ships NETWORK_CONNECT_NETWORKS with its only entry commented out, and the owner then
+// deploys containers here onto a network named in the *owner's* templates. An empty list is what
+// left twelve containers created against a network that did not exist.
+//
+// Outside the create block above, so it applies to a conf that already exists — the wizard is
+// re-runnable and a mirror rebuilt against an existing host conf needs this just as much.
+//
+// Merged, never replaced: anything already listed here was put there deliberately.
+$netsRaw = trim((string)($_POST['networks'] ?? ''));
+if ($netsRaw !== '' && $hostIdLow !== 'host1') {
+    // Written into a file that bash sources, so the name is validated rather than trusted.
+    // Docker's own charset for a network name is a superset of this; anything outside it is
+    // far more likely to be an injection attempt than a real network.
+    $nets = array_values(array_filter(
+        array_map('trim', explode(',', $netsRaw)),
+        fn($n) => $n !== ''
+               && preg_match('/^[A-Za-z0-9][A-Za-z0-9._-]{0,62}$/', $n)
+               && !preg_match('/^(bridge|host|none|br\d)/i', $n)
+    ));
+    if ($nets) {
+        $netVar = $hostId . '_NETWORK_CONNECT_NETWORKS';
+        vv_conf_edit($confFile, function (string $cur) use ($netVar, $nets): ?string {
+            $existing = vv_parse_conf_list($cur, $netVar);
+            $merged   = $existing;
+            foreach ($nets as $n) {
+                if (!in_array($n, $merged, true)) $merged[] = $n;
+            }
+            if ($merged === $existing) return null;   // already adopted — no write, no audit noise
+            $body = '';
+            foreach ($merged as $n) $body .= '        "' . $n . '"' . "\n";
+            $new = preg_replace(
+                '/^(\s*' . preg_quote($netVar, '/') . '\s*=\s*\()(.*?)(^\s*\))/ms',
+                "\$1\n" . $body . '$3', $cur, 1, $count);
+            return ($count === 1 && $new !== null) ? $new : null;
+        }, [], [$netVar]);
+    }
+}
+
 // Write setup state file — lets partner servers know HOST1 is configured.
 // Read-modify-write: vv_setup_state_write() replaces the file wholesale, and re-running the
 // wizard must not erase onboarding progress recorded by the partnership phases.